Skip to content
This repository has been archived by the owner on Jun 23, 2023. It is now read-only.

PelDataWindow.php: Offset -1 not within [0, 1] #141

Open
myxor opened this issue Sep 3, 2019 · 7 comments
Open

PelDataWindow.php: Offset -1 not within [0, 1] #141

myxor opened this issue Sep 3, 2019 · 7 comments

Comments

@myxor
Copy link

myxor commented Sep 3, 2019

During scan process of https://github.com/nextcloud/maps which uses "lsolesen/pel": "^0.9.6" it crashes at the same picture every time with the following error message:

PelDataWindow.php: Offset -1 not within [0, 1]

I do not exactly know what's wrong but here is some information i was able to gather:

I extracted the exif data with imagemagick:

identify -verbose IMG_20141003_144721.jpg | grep "exif:
    exif:ColorSpace: 1
    exif:ComponentsConfiguration: 206, 4, 0, 0
    exif:CustomRendered: 0
    exif:DateTime: 1970:01:01 01:00:00
    exif:DateTimeDigitized: 2014:10:03 14:47:22
    exif:DateTimeOriginal: 2014:10:03 14:47:22
    exif:ExifOffset: 534
    exif:ExifVersion: 220, 0, 0, 0
    exif:ExposureBiasValue: 0/2
    exif:ExposureMode: 0
    exif:ExposureTime: 613/1000000
    exif:Flash: 0
    exif:FNumber: 260/100
    exif:FocalLength: 354/100
    exif:GPSImgDirection: 354/1
    exif:GPSImgDirectionRef: M
    exif:GPSInfo: 564
    exif:ImageLength: 1920
    exif:ImageWidth: 2560
    exif:JPEGInterchangeFormat: 600
    exif:JPEGInterchangeFormatLength: 11368
    exif:Make: SAMSUNG
    exif:MaxApertureValue: 276/100
    exif:MeteringMode: 2
    exif:Model: GT-I8190
    exif:Orientation: 1
    exif:ResolutionUnit: 2
    exif:SceneCaptureType: 0
    exif:Software: d72ff736f2
    exif:UserComment: User comments
    exif:WhiteBalance: 0
    exif:XResolution: 72/1
    exif:YCbCrPositioning: 2
    exif:YResolution: 72/1
    Profile-exif: 608 bytes

Additionally i attached the image here:

IMG_20141003_144721
@myxor
Copy link
Author

myxor commented Sep 3, 2019

I just saw that this is pretty much a duplicate from nextcloud/maps#96 which is then fixed in nextcloud/maps#91.
Although maybe you wanna fix the cause of the crash here?

@mondrake mondrake mentioned this issue Jun 12, 2020
Merged
@ivangrozni
Copy link
Contributor

the issue is just gracefully handled in nextcloud and not fixed. It should be fixed here. I've been looking into this issue because I'm encountering it with drupal file_mdm module (https://www.drupal.org/project/file_mdm/issues/3271212). What I know so far is that the exif Orientation is causing it.

Similarly as the image above the imagemagick identify return 1 for exif Orientation but PelJpeg is erroring out with (PelDataWindow::validateOffset):

use lsolesen\pel\PelJpeg
>>> $p=new PelJpeg($uri);
lsolesen\pel\PelDataWindowOffsetException with message 'Offset -1 not within [0, 5798]'

@ivangrozni
Copy link
Contributor

So here's the output with loading the image with Pel::setDebug(TRUE);

Initializing PelJpeg object from public://2022-03/zzz.jpg
Parsing 1263246 bytes...
Found APP0 section of length 14
Found APP1 section of length 8871
Parsing 8871 bytes of Exif data...
Parsing 8865 bytes of TIFF data...
Found Intel byte order
First IFD at offset 8.
Constructing IFD at offset 8 from 8865 bytes...
Loading 18 entries...
Loading entry with tag 0x0101: ImageLength (1 of 18)...
Loading entry with tag 0x0102: BitsPerSample (2 of 18)...
Loading entry with tag 0x0106: PhotometricInterpretation (3 of 18)...
Loading entry with tag 0x010E: ImageDescription (4 of 18)...
Loading entry with tag 0x010F: Make (5 of 18)...
Loading entry with tag 0x0110: Model (6 of 18)...
Loading entry with tag 0x0112: Orientation (7 of 18)...
Loading entry with tag 0x0115: SamplesPerPixel (8 of 18)...
Loading entry with tag 0x011A: XResolution (9 of 18)...
Loading entry with tag 0x011B: YResolution (10 of 18)...
Loading entry with tag 0x0128: ResolutionUnit (11 of 18)...
Loading entry with tag 0x0131: Software (12 of 18)...
Loading entry with tag 0x0132: DateTime (13 of 18)...
Loading entry with tag 0x8769: ExifIFDPointer (14 of 18)...
Found sub IFD at offset 1664
Constructing IFD at offset 1664 from 8865 bytes...
Loading 41 entries...
Loading entry with tag 0x829A: ExposureTime (1 of 41)...
Loading entry with tag 0x829D: FNumber (2 of 41)...
Loading entry with tag 0x8822: ExposureProgram (3 of 41)...
Loading entry with tag 0x8827: ISOSpeedRatings (4 of 41)...
Loading entry with tag 0x8830: Unknown: 0x8830 (5 of 41)...
Warning: IFD Exif cannot hold
  Tag: 0x8830 (Unknown: 0x8830)
    Format    : 3 (Short)
    Components: 1
    Value     : 2
    Text      : 2
 (PelIfd.php:1165)
Loading entry with tag 0x8832: Unknown: 0x8832 (6 of 41)...
Warning: IFD Exif cannot hold
  Tag: 0x8832 (Unknown: 0x8832)
    Format    : 4 (Long)
    Components: 1
    Value     : 500
    Text      : 500
 (PelIfd.php:1165)
Loading entry with tag 0x9000: ExifVersion (7 of 41)...
Loading entry with tag 0x9003: DateTimeOriginal (8 of 41)...
Loading entry with tag 0x9004: DateTimeDigitized (9 of 41)...
Loading entry with tag 0x9201: ShutterSpeedValue (10 of 41)...
Loading entry with tag 0x9202: ApertureValue (11 of 41)...
Loading entry with tag 0x9204: ExposureBiasValue (12 of 41)...
Loading entry with tag 0x9205: MaxApertureValue (13 of 41)...
Loading entry with tag 0x9206: SubjectDistance (14 of 41)...
Loading entry with tag 0x9207: MeteringMode (15 of 41)...
Loading entry with tag 0x9208: LightSource (16 of 41)...
Loading entry with tag 0x9209: Flash (17 of 41)...
Loading entry with tag 0x920A: FocalLength (18 of 41)...
Loading entry with tag 0x9286: UserComment (19 of 41)...
Loading entry with tag 0x9291: SubSecTimeOriginal (20 of 41)...
Loading entry with tag 0x9292: SubSecTimeDigitized (21 of 41)...
Loading entry with tag 0xA000: FlashPixVersion (22 of 41)...
Loading entry with tag 0xA001: ColorSpace (23 of 41)...
Loading entry with tag 0xA002: PixelXDimension (24 of 41)...
Loading entry with tag 0xA003: PixelYDimension (25 of 41)...
Loading entry with tag 0xA217: SensingMethod (26 of 41)...
Loading entry with tag 0xA300: FileSource (27 of 41)...
Loading entry with tag 0xA301: SceneType (28 of 41)...
Loading entry with tag 0xA401: CustomRendered (29 of 41)...
Loading entry with tag 0xA402: ExposureMode (30 of 41)...
Loading entry with tag 0xA403: WhiteBalance (31 of 41)...
Loading entry with tag 0xA405: FocalLengthIn35mmFilm (32 of 41)...
Loading entry with tag 0xA406: SceneCaptureType (33 of 41)...
Loading entry with tag 0xA407: GainControl (34 of 41)...
Loading entry with tag 0xA408: Contrast (35 of 41)...
Loading entry with tag 0xA409: Saturation (36 of 41)...
Loading entry with tag 0xA40A: Sharpness (37 of 41)...
Loading entry with tag 0xA40C: SubjectDistanceRange (38 of 41)...
Loading entry with tag 0xA431: Unknown: 0xA431 (39 of 41)...
Warning: IFD Exif cannot hold
  Tag: 0xA431 (Unknown: 0xA431)
    Format    : 2 (Ascii)
    Components: 8
    Value     : 6009721
    Text      : 6009721
 (PelIfd.php:1165)
Loading entry with tag 0xA432: Unknown: 0xA432 (40 of 41)...
Warning: IFD Exif cannot hold
  Tag: 0xA432 (Unknown: 0xA432)
    Format    : 5 (Rational)
    Components: 4
    Value     : Array
(
    [0] => Array
        (
            [0] => 350
            [1] => 10
        )

    [1] => Array
        (
            [0] => 350
            [1] => 10
        )

    [2] => Array
        (
            [0] => 20585492
            [1] => 14703923
        )

    [3] => Array
        (
            [0] => 20585492
            [1] => 14703923
        )

)

    Text      : 350/10, 350/10, 20585492/14703923, 20585492/14703923
 (PelIfd.php:1165)
Loading entry with tag 0xA434: Unknown: 0xA434 (41 of 41)...
Warning: IFD Exif cannot hold
  Tag: 0xA434 (Unknown: 0xA434)
    Format    : 2 (Ascii)
    Components: 39
    Value     : Sigma 35mm F1.4 DG HSM | Art (Nikon F)
    Text      : Sigma 35mm F1.4 DG HSM | Art (Nikon F)
 (PelIfd.php:1165)
Current offset is 1666, link at 2158 points to 0.
Last IFD.
Loading entry with tag 0x8825: GPSInfoIFDPointer (15 of 18)...
Found sub IFD at offset 2954
Constructing IFD at offset 2954 from 8865 bytes...
Loading 1 entries...
Loading entry with tag 0x0000: GPSVersionID (1 of 1)...
Current offset is 2956, link at 2968 points to 0.
Last IFD.
Loading entry with tag 0x9C9B: WindowsXPTitle (16 of 18)...
Loading entry with tag 0x9C9E: WindowsXPKeywords (17 of 18)...
Loading entry with tag 0x9C9F: WindowsXPSubject (18 of 18)...
Current offset is 10, link at 226 points to 2972.
Constructing IFD at offset 2972 from 8865 bytes...
Loading 6 entries...
Loading entry with tag 0x0103: Compression (1 of 6)...
Loading entry with tag 0x011A: XResolution (2 of 6)...
Loading entry with tag 0x011B: YResolution (3 of 6)...
Loading entry with tag 0x0128: ResolutionUnit (4 of 6)...
Loading entry with tag 0x0201: JPEGInterchangeFormat (5 of 6)...
Loading entry with tag 0x0202: JPEGInterchangeFormatLength (6 of 6)...

In PelDataWindow.php line 234:
                                  
  Offset -1 not within [0, 5798]

@ivangrozni
Copy link
Contributor

I think I've found the error:
PelIfd::safeSetThumbnail method is only catching PelDataWindwoWindowException but setThumbnail is throwing PelDataWindowOffset exception.

@ivangrozni ivangrozni mentioned this issue Mar 26, 2022
Merged
@ivangrozni
Copy link
Contributor

Here's a PR that tries to address this issue: #200

@weberhofer
Copy link
Collaborator

This issue could be fixed with #200, I have added a test-case with #201

I could not reproduce the issue with the image uploaded in this ticket. Please let me know, if the issue has been resolved with today's development version.

@ivangrozni
Copy link
Contributor

ivangrozni commented Apr 13, 2022 •
edited
Loading

Hello, I'd like to give this issue another push. I've noticed some more Offset <num1> not within [0,<num2>]errors. It looks like the error is thrown in some other places as well not only PelIfd::safeSetThumbnail. This is also supported by the claim that error message doesn't include PelDataWindowOffsetException in the error message as it is in safeSetThumbnail catch statement Pel::maybeThrow(new PelIfdException('PelDataWindowOffsetException: ' . $e->getMessage()));

Probably we have to look more where PelDataWindow::getBytes method is called.

Images that are causing the issue:
[error] Error getting exif ('Orientation') metadata for public://2020-09/200969_190905_gbi_leopold_unger_platz_cam_01-b2.jpg. Message: Offset -1 not within [0, 3161476]
https://cp8.wirtschaftsverlag.at/sites/contentpool/files/public/2020-09/200969_190905_gbi_leopold_unger_platz_cam_01-b2.jpg
[error] Error getting exif ('Orientation') metadata for public://2021-10/gettyimages-1305355118.jpg. Message: Offset -520 not within [0, 6652]
https://cp8.wirtschaftsverlag.at/sites/contentpool/files/public/2021-10/gettyimages-1305355118.jpg

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@weberhofer @myxor @ivangrozni